Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Chapter 19: Auditing and Reporting
Auditing on the Sidewinder G2
534
To view a list of audit databases, enter the following command:
cf audit listdb
A list of audit databases appears. The database named auditdb_1 generally
contains the previous day’s information. The database named
auditdb_2 is generally from two days ago, and so on.
Understanding audit file names
The /var/log/audit.raw files contains all audit information and network probe
audits contained on the Sidewinder G2 in a binary format. When the file is
rolled, a timestamp is appended to the file name. The easiest method for
viewing the contents of the audit.raw files is to use the Admin Console’s Audit
Viewing window. Refer to “Viewing audit information” on page 534.
Tip: If you prefer to view the file contents via command line, refer to the
showaudit and acat man pages.
Audit log files use one of two file suffixes:
• *.gz — This suffix is for files in compressed format. These files may be
decompressed using acat or showaudit. The default file name format is
audit.raw.YYYYMMDDhhmmssZZZ.YYYYMMDDhhmmssZZZ.gz, where
the variables represent date and time (including time zone) of the beginning
and end of that audit file’s contents. For example,
20051231020000CST.20060101020000CST.gz is a file that contains audit
data from December 31, 2005 at 2:00 am to January 1, 2006 at 2:00 am.
• *.raw — This suffix is for files in raw audit format. These are binary
formatted files that can be viewed in ASCII format using the Admin Console
or command line.
Viewing audit information
Using the Admin Console, you can view the information contained in the audit
log files. The Admin Console Audit Viewing window allows you to view audit
information in real time, or for a specific time frame that you select. You can
also apply filters to view specific types of audit information within a specific time
frame. To view audit information using the Admin Console, follow the steps
below.
Using the Admin Console, select Audit and Reports > Audit Viewing. The
following window appears.